tcp: md5: check md5 signature without socket lock

Since a8afca032 (tcp: md5: protects md5sig_info with RCU) tcp_md5_do_lookup
doesn't require socket lock, rcu_read_lock is enough. Therefore socket lock is
no longer required for tcp_v{4,6}_inbound_md5_hash too, so we can move these
calls (wrapped with rcu_read_{,un}lock) before bh_lock_sock:
from tcp_v{4,6}_do_rcv to tcp_v{4,6}_rcv.

Signed-off-by: Dmitry Popov <ixaphire@qrator.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 992a1f9..dceff5f 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1167,7 +1167,8 @@ clear_hash_noput:
 }
 EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
 
-static bool tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
+static bool __tcp_v4_inbound_md5_hash(struct sock *sk,
+                                     const struct sk_buff *skb)
 {
        /*
         * This gets called for each TCP segment that arrives
@@ -1220,6 +1221,17 @@ static bool tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
        return false;
 }
 
+static bool tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
+{
+       bool ret;
+
+       rcu_read_lock();
+       ret = __tcp_v4_inbound_md5_hash(sk, skb);
+       rcu_read_unlock();
+
+       return ret;
+}
+
 #endif
 
 static void tcp_v4_init_req(struct request_sock *req, struct sock *sk,
@@ -1432,16 +1444,6 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 {
        struct sock *rsk;
-#ifdef CONFIG_TCP_MD5SIG
-       /*
-        * We really want to reject the packet as early as possible
-        * if:
-        *  o We're expecting an MD5'd packet and this is no MD5 tcp option
-        *  o There is an MD5 option and we're not expecting one
-        */
-       if (tcp_v4_inbound_md5_hash(sk, skb))
-               goto discard;
-#endif
 
        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
                struct dst_entry *dst = sk->sk_rx_dst;
@@ -1644,6 +1646,18 @@ process:
 
        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                goto discard_and_relse;
+
+#ifdef CONFIG_TCP_MD5SIG
+       /*
+        * We really want to reject the packet as early as possible
+        * if:
+        *  o We're expecting an MD5'd packet and this is no MD5 tcp option
+        *  o There is an MD5 option and we're not expecting one
+        */
+       if (tcp_v4_inbound_md5_hash(sk, skb))
+               goto discard_and_relse;
+#endif
+
        nf_reset(skb);
 
        if (sk_filter(sk, skb))

diff --cc net/ipv6/tcp_ipv6.c
Simple merge